diff options
| -rw-r--r-- | source4/kdc/policy.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/source4/kdc/policy.c b/source4/kdc/policy.c index e9cc608e10..4109cb4c85 100644 --- a/source4/kdc/policy.c +++ b/source4/kdc/policy.c @@ -29,17 +29,21 @@ void kdc_get_policy(struct loadparm_context *lp_ctx, struct smb_krb5_context *smb_krb5_context, struct lsa_DomainInfoKerberos *k) { + time_t svc_tkt_lifetime; + time_t usr_tkt_lifetime; + time_t renewal_lifetime; + /* These should be set and stored via Group Policy, but until then, some defaults are in order */ /* Our KDC always re-validates the client */ k->authentication_options = LSA_POLICY_KERBEROS_VALIDATE_CLIENT; - unix_to_nt_time(&k->service_tkt_lifetime, - lpcfg_parm_int(lp_ctx, NULL, "kdc", "service ticket lifetime", 10) * 60 * 60); - unix_to_nt_time(&k->user_tkt_lifetime, - lpcfg_parm_int(lp_ctx, NULL, "kdc", "user ticket lifetime", 10) * 60 * 60); - unix_to_nt_time(&k->user_tkt_renewaltime, - lpcfg_parm_int(lp_ctx, NULL, "kdc", "renewal lifetime", 24*7) * 60 * 60); + lpcfg_default_kdc_policy(lp_ctx, &svc_tkt_lifetime, + &usr_tkt_lifetime, &renewal_lifetime); + + unix_to_nt_time(&k->service_tkt_lifetime, svc_tkt_lifetime); + unix_to_nt_time(&k->user_tkt_lifetime, usr_tkt_lifetime); + unix_to_nt_time(&k->user_tkt_renewaltime, renewal_lifetime); if (smb_krb5_context) { unix_to_nt_time(&k->clock_skew, krb5_get_max_time_skew(smb_krb5_context->krb5_context)); |